Skip to content
Commit 72048780 authored by Abhishek Patel's avatar Abhishek Patel Committed by Gunnar Mills
Browse files

Modify entityPrivileges for certificate service



DMTF published new entity privileges for certificate service classes
which modify entity privilege Certificate, CertificateCollection,
CertificateLocations, and CertificateService on bmcweb. Modification
restricts a user without "ConfigureManager" from accessing the
CertificateCollection and Certificate scehamas

Redfish is a hypermedia API where the parent URI describes sub-URI.
Thus, restricting sub-URI in a parent-URI data helps to forbidden user
access, stricken the rule.  So sub-URI only gets display if a user has
access to that URI.

Restricting the link allows the Redfish Validator to pass.

These impact roles without ConfigureManager, which include operator
and read-only. No access is not impacted since it already did not
have access.

The following are bmcweb user consequences:
1. ReadOnly and Operator role users are no longer able to view
   certificates or the certificate collection (LDAP, HTTPS, TrustStore)
2. Operator role users are no longer able to replace the certificates
   (LDAP, HTTPS, TrustStore), Install certificates (LDAP, HTTPS,
   TrustStore) or delete the Truststore Certificate. HTTPS and LDAP
   certificates do not have delete methods.

Resolves openbmc/bmcweb#61

Tested: manually tested on Witherspoon system and run Redfish-Service-
Validator with all roles root, operator, read-only, and No access. Test
pass for root, operator, and read-only roles, And new errors get
introduced for no access role.

Signed-off-by: default avatarAbhishek Patel <Abhishek.Patel@ibm.com>
Change-Id: Ibc5eed7db7e224e46f8572df8bcfba2a1ff47644
parent 7c8c4058
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment